A WordPress core flaw that lets attackers run code during updates is being exploited. Here is who is affected, what to do now and how it can hit your SEO.
A WordPress core vulnerability that lets attackers run code on a site while it’s updating is now being used in real attacks. The US cybersecurity agency CISA added it to its list of known exploited vulnerabilities on 3 November 2026, and the fix is in WordPress 7.1.4, released on 28 October.
If your business runs on WordPress, check today that you’re on 7.1.4 or a patched older branch. A hacked site doesn’t just risk your data. It can also cost you your Google rankings, your click-through rate and the trust of anyone who lands on a warning page instead of your homepage.
Updated 5 November 2026. We’ll update this post if the affected versions or advice change.
What happened
The flaw, tracked as CVE-2026-119977, is a race condition in the WordPress core upgrade process. During a full core update, WordPress briefly puts files in predictable, web-accessible staging locations. An attacker who reaches those files at the right moment can run their own code on the server, without logging in.
It was reported by Umut Bayram of Picus Security and fixed in WordPress 7.1.4. The official release note describes it as a weakness in the upgrade process that can lead to remote code execution during the upgrade window, and says fixes are being backported to older branches as far back as 4.7.
Attackers moved quickly. Wordfence, the WordPress security firm, reported thousands of blocked attempts within a day, aimed at the staged installer files that only exist during an update. The Hacker News and BleepingComputer both reported CISA’s warning on 4 November.
Who is affected
Any WordPress site that runs a full core update on a version without the fix. The attack only works during the update itself, which makes it harder to pull off than many flaws. But WordPress sites update often, and attackers are scanning for that window at scale.
What isn’t confirmed yet is the exact list of affected versions on each older branch. If you’re not on the 7.1 branch, check your host or the WordPress release notes for the patched version of your branch rather than assuming you’re safe.
Why this matters for your SEO
Most of the damage from a hacked WordPress site shows up in search before anyone notices it on the site itself. It’s the same pattern we covered with the PHP2Shell flaw. Once attackers can run code, the common results are:
- Spam pages injected into your site. Thousands of pages selling pills, casino links or fake goods, often hidden from logged-in users so you never see them.
- Warnings in Google. Google can label your listing “This site may be hacked”, and browsers can show a full-page security warning. Click-through rates collapse.
- Manual actions. Google can apply a manual action for hacked content, which can push pages out of search until it’s cleaned up and reviewed.
- Hidden redirects and links. Visitors from Google get sent elsewhere, and outbound spam links damage the trust your site has built.
Cleaning up is possible, but recovering lost visibility can take weeks or months. Patching takes minutes.
What to do now
- Check your version. In WordPress, go to Dashboard, then Updates. You want 7.1.4, or the patched release for your branch.
- Update today. If automatic background updates are on, the update may already have run, but don’t assume it. Take a backup first, then update.
- Ask your host. Managed WordPress hosts often patch for you. Get it confirmed in writing for every site you run, including old campaign and microsites.
- Check Search Console. Look at the Security issues and Manual actions reports. Both should say no issues detected.
- Look for spam pages. Search Google for site:yourdomain.com with words like casino, viagra or loan. Anything unexpected needs investigating.
- Review your users and files. Look for admin users you don’t recognise and recently changed files in the WordPress root. If you find anything, change all passwords and bring in a developer or your host.
What we’re watching
We’ll update this post when the full list of patched older branches is confirmed, and if Google or the WordPress security team publish further guidance. In the meantime, the safest assumption is that any unpatched site that updated in the last few weeks is worth checking.
If you’re not sure whether your site was hit, or your traffic has dropped and you don’t know why, our technical SEO team can check it as part of an SEO audit. For WordPress sites specifically, see our WordPress SEO service, or book a free strategy session and we’ll talk it through.
Related reading: our guides to negative SEO and why HTTPS matters for SEO.
Common questions
Which WordPress version fixes the upgrade flaw?
WordPress 7.1.4, released on 28 October 2026, fixes it. Patches are also being backported to older branches as far back as 4.7, so check the patched release for your branch.
Is the WordPress upgrade flaw being exploited?
Yes. CISA added it to its list of known exploited vulnerabilities on 3 November 2026, and Wordfence reported thousands of attack attempts within a day.
Can a hacked WordPress site lose its Google rankings?
Yes. Hacked sites often get spam pages injected, a “This site may be hacked” label in Google or a manual action, all of which can cut traffic sharply until the site is cleaned up.
How do I check if my site was hacked?
Check the Security issues and Manual actions reports in Search Console, search Google for spam words on your domain, and look for unknown admin users or recently changed files.
